severity 748964 wishlist tags 748964 + wontfix thanks Hi Kurt
It turns out that vzstats does not work with ca-certificates. I'd like to know the reason for this request. Is it some general principle or is it some more specific reason for it? ola@quartz:~/build/debian/vzstats/vzstats-0.5.3$ curl -sS --connect-timeout 30 --cacert /etc/ssl/certs/ca-certificates.crt https://stats.openvz.org/genuuid.php curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. This problem does not appear with the certificate from vzstats itself. There is one more problem. A server admin can select and deny CA:s by configuration. This is all good, but it is very hard for the admin to dig down that it is because of a specific setting this statistics gathering script stops to work. So I prefer not to change this, unless there is a very good reason to do that. Cheers // Ola On Fri, May 23, 2014 at 10:12 PM, Ola Lundqvist <o...@inguza.com> wrote: > Hi Kurt > > I have checked now and it uses it when using curl as client. > This means that it should be quite trivial to fix. > > Thanks for the report. > > // Ola > > > On Fri, May 23, 2014 at 10:09 PM, Ola Lundqvist <o...@inguza.com> wrote: > >> Hi Kurt >> >> Thanks for the report. I'll look into this and also report this to >> upstream. I can not see any obvious reasons why a ca-bundle is included at >> all. >> >> // Ola >> >> >> On Thu, May 22, 2014 at 7:07 PM, Kurt Roeckx <k...@roeckx.be> wrote: >> >>> Package: vzstats >>> Version: 0.5.2-1 >>> >>> Hi, >>> >>> Your package contains a ca-bundle with the certificates from the >>> mozilla root program. Could you please switch to those provided >>> by the ca-certificates package? >>> >>> >>> Kurt >>> >> >> >> >> -- >> --- Inguza Technology AB --- MSc in Information Technology ---- >> / o...@inguza.com Annebergsslingan 37 \ >> | o...@debian.org 654 65 KARLSTAD | >> | http://inguza.com/ Mobile: +46 (0)70-332 1551 | >> \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / >> --------------------------------------------------------------- >> >> > > > -- > --- Inguza Technology AB --- MSc in Information Technology ---- > / o...@inguza.com Annebergsslingan 37 \ > | o...@debian.org 654 65 KARLSTAD | > | http://inguza.com/ Mobile: +46 (0)70-332 1551 | > \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / > --------------------------------------------------------------- > > -- --- Inguza Technology AB --- MSc in Information Technology ---- / o...@inguza.com Annebergsslingan 37 \ | o...@debian.org 654 65 KARLSTAD | | http://inguza.com/ Mobile: +46 (0)70-332 1551 | \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / ---------------------------------------------------------------
